Systems and methods for switching between autonomous and manual operation of a vehicle

ABSTRACT

Systems and methods for switching between autonomous and manual operation of a vehicle are described. In one embodiment, there is a mechanical control system that receives manual inputs from a mechanical operation member to operate the vehicle in manual mode. There is further an actuator that receives autonomous control signals generated by a controller. When the actuator is engaged, it operates the vehicle in an autonomous mode, and when disengaged, it operates the vehicle in manual mode. In another embodiment, there is an E-Stop system to disengage systems that cause the vehicle to move, such as the engine, while still leaving power in the systems that do not cause the vehicle to move. There is a method for autonomous mode starting of a vehicle, comprising receiving a signal indicating autonomous mode, determining that a parking brake lever is set and the brakes are engaged, disengaging the brakes while maintaining the lever in the set position, and engaging in autonomous mode. There is a safety system with a mechanical bias to suppress moveable systems of the vehicle, comprising a clutch that releases the mechanical bias to permit movement of the moveable system when the clutch is engaged. In another embodiment a system comprises a mechanical linkage with a restoration member that permits control of an operation system of the vehicle by a remote operation member when the restoration member is engaged. There is also an actuator that prohibits control of the operation system by the remote operation member when the actuator is engaged.

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 60/729,445, filed Oct. 21, 2005, U.S. Provisional Patent ApplicationNo. 60/729,388, filed Oct. 21, 2005, U.S. Provisional Patent ApplicationNo. 60/780,389, filed Mar. 8, 2006, and U.S. Provisional PatentApplication No. 60/838,704, filed Aug. 18, 2006, each of which isincorporated herein by reference in its entirety.

This application is related to U.S. Patent Applications entitled“Robotic Control Module”[Attorney Docket No. 56516/335073]; “Systems andMethods for Obstacle Avoidance” [Attorney Docket No. 56516/335072]; and“Networked Multi-Role Robotic Vehicle” [Attorney Docket No.56516/335069], each of which is filed herewith and incorporated hereinby reference in its entirety.

FIELD OF THE INVENTION

This invention relates generally to systems and methods for vehicleoperation. More particularly, embodiments of this invention relate tosystems and methods for switching between autonomous and manualoperations of a vehicle.

BACKGROUND OF THE INVENTION

In October 2005, five autonomous vehicles successfully completed the“Grand Challenge” of the United States Defense Department's AdvancedResearch Projects Administration (DARPA), a competition requiring fullyrobotic vehicles to traverse a course covering more than one hundredmiles. These vehicles were outfitted with robotic control systems inwhich a bank of computers control all of the operational systems of thevehicle, such as the steering, braking, transmission, and throttle,subject to autonomous decisions made by programs on board the vehicle,without human intervention on the course itself.

While the designers and builders of these vehicles have made animpressive accomplishment, the vehicles themselves were converted intospecial-purpose robots. There is no requirement in the competition forthe vehicles to also be drivable by an operator, so only a few were.Even those that were drivable were not necessarily drivable in anordinary manner. For example, a steering wheel on such a vehicle mightstill be turned by a human, but would encounter unnatural and sometimesdangerous resistance from a still-attached robotic actuator. While it isknown that some of the vehicles were driven to the site on each day ofcompetition, none are known to have been equally capable as autonomousvehicles and as manually driven vehicles. None were safe both in anautonomous role and in a manual role—the course was cleared of allspectators, and passengers were not allowed during autonomous operation.None had much, if any, provision for considering how an operator maysafely and naturally interact with the vehicle.

With respect to switching between autonomous and manual use, roboticconversion of a vehicle can result in a conversion from conventionalcabled and hydraulic control (direct mechanical control) to indirectcontrol systems referred to as drive-by-wire systems. In drive-by-wiresystems an actuator, such as an electric motor or hydraulic cylinder,applies throttle, braking, and/or steering input. These drive-by-wiresystems do not have a connection to an operable mechanical control forordinary driving (such as a lever, pedal, or steering wheel directlyoperated by cable tension or hydraulic lines). Converted vehicles becomemostly or entirely drive-by-wire because they are usually not intendedto be freely converted back to or switchable back to a manually drivenconfiguration. Even if some operation systems can be operated by adriver, the conversion will use the intervening robotic software,electronics, and actuators (for example, the usual cabled acceleratormay be disconnected, so that an operator may input a speed choice via ajoystick or the like).

Retrofitted vehicles that use the intervening robotic software,electronics, and actuators in place of a disabled mechanical connectioncannot be considered equally as capable as a conventional vehicle. Theymay be fully or partially disabled upon failure of robotic controlsystems. It may be difficult for passengers in such a vehicle to recoverfrom accidents, e.g., removing the vehicle from a ditch if it becomesstuck. In extreme scenarios, such as military operations, a converted“one-way” vehicle lacks flexibility.

Trivial software problems may strand a drive-by-wire vehicle, at leastbecause there are no mechanical connections for a driver to resume useof the basic operational systems of the vehicle. Knownconverted-to-robotics vehicles inherit this problem, and cannot bereadily changed into fully manual vehicles at whim. There are otherproblems—for example, converted vehicles do not drive or perform in themanner of an unmodified vehicle from an operator's perspective. Simpleactivities, such as parking the vehicle in a garage or transport, may bemore difficult than doing so in an ordinary manual vehicle, requiringcomplex programming or use of tele-operation.

To the extent that the prior art has contemplated some of the problemsand opportunities associated with vehicles useful in both autonomousmodes and manual modes, ergonomic and intuitive operation is usually notthe primary problem addressed. For example, although it may becontemplated that one manual operation or another may be associated withswitching between autonomous and manual modes, specific, ergonomicallydetermined mode switching methods are not well defined. Moreover,specific mechanical accommodation for intuitive operator use of modeswitching systems is rarely discussed.

SUMMARY

Embodiments of this invention provide a vehicle, structures, systems,and methods, that are equally capable in autonomous and manual modes:(i) by incorporating enhanced safety in all such modes; (ii) by beingreadily restorable to fully mechanical manual operation and switchableto fully autonomous operation; (iii) by efficiently overlapping andcombining components of autonomous control systems, manual mechanicalcontrol systems, and safety systems; or (iv) by having a human interfacethat simplifies processes of switching between autonomous and manualoperations of a vehicle and enhances the operability and safety ofvehicle use in either mode.

For example, one embodiment of the present invention comprises anautonomous vehicle including a mechanical vehicle control system capableof receiving manual inputs to operate the vehicle in a manual mode; acontroller capable of generating autonomous control signals and/or modeswitch signals; and at least one actuator mated to the mechanicalvehicle control system by at least one electrically actuated clutch. Theactuator may receive the autonomous control signals, and may operate themechanical vehicle control system in an autonomous mode. Upon receipt ofthe mode switch signal, the actuator may disengage from the mechanicalvehicle control system so that the vehicle operates in manual mode.

Thus the vehicle may be controlled by an operator in the vehicle usingthe mechanical vehicle control systems, or by a remote entity using theautonomous control system. Retaining manual functionality in this mannerpermits the operator experience to be indistinguishable from driving avehicle with no autonomous modes. An operator accustomed to driving anunmodified vehicle or vehicle of the same base platform will experiencesubstantially the same tactile feedback from driving the multi-rolevehicle as from driving a normal non-autonomous vehicle (using steering,accelerator, brakes, or gear shifting) of the same kind.

Another embodiment of the present invention is a vehicle that includes asafety stop system that enhances safety in all modes and efficientlyoverlaps and combines components of autonomous control systems, manualmechanical control systems, and safety systems. The safety stop systemremoves power from all moving parts and from all parts that cause thevehicle to move. The e-Stop system is a subsystem of the safety stopsystem. It includes normally disengaged electrical clutches associatedwith each system that causes the vehicle to move and powers down all ofthe clutches in an E-Stop. In one embodiment, even though the E-Stopremoves power from the clutches, it leaves power in the autonomouscontrol system. After an E-Stop the vehicle is immediately available tobe driven by the operator via the mechanical vehicle operation systems.Because supervisory and other autonomous control systems remain powered,however, autonomous functions such as sensing, communications,recording, monitoring, etc., are allowed to continue. E-Stop can betriggered by E-Stop switches within the vehicle, or by operator controlmembers for the mechanical vehicle operation systems, such as the brakepedal.

The safety stop system also includes a controlled stop subsystem thatstops the vehicle by removing power from only selected normallydisengaged electrical clutches, while leaving other selected clutchesactive. An E-Stop could be initiated after a controlled stop, shuttingdown remaining moving parts. Optionally, a mode changeover switch forswitching between manual mode and autonomous modes, or betweenautonomous modes, also removes power from selected normally disengagedelectrical clutches, which may or may not stop the vehicle, and may alsoleave all of the remaining powered moving parts active.

In another embodiment of the present invention, a vehicle includes anautonomous mode starting system and method that provide features toenhance safety. The vehicle includes a parking control element that isset in a predetermined setting when the vehicle is parked. Thispredetermined setting should be commonly perceived as signifyingdisabling movement, e.g., should be part of the ordinary rules of theroad and/or ordinary driver training. For example, there may be aparking brake lever that is set in the “set position,” so that theparking brake lever extends upwards and is visible from outside thevehicle. The vehicle's control system interprets the predeterminedsetting as permitting autonomous mode. There may be a disengagingmechanism that is responsive to signals sent by the control system. Thedisengaging mechanism disengages the mechanism preventing autonomousmovement, yet leaves the control element in the predetermined settingthat signifies disabled movement. So for example, the disengagingmechanism would release the brakes so that the vehicle can move, butwould not release the parking brake lever, which would remain in the“set position.” Optionally, the disengaging mechanism is electrical andwould be deactivated under E-Stop or power loss conditions. It isoptional, but advantageous, to leave the parking control electricallydisengaged but mechanically “charged,” or mechanically biased. In thismanner, the parking control can be reengaged under electrical control orcan fail-safe to a braking condition when electrical power is lost.

In another embodiment of the invention, a robotics safety system isprovided for enhancing safety when the vehicle is in autonomous mode anda passenger desires to use manual mode. In autonomous mode electricalclutches are engaged to prohibit operation in manual mode. The vehiclehas a set of manual operation members, such as levers and steeringwheels, that are accessible to the passengers. When a passenger movesany of the manual operation members the electrical clutches disengage topermit operation in manual mode, and prohibit operation in autonomousmode. In another embodiment, the robotics safety system may include arocker switch or other switch with autonomous and manual settings thatpassengers may use to switch between modes. Before switching betweenmodes the robotics safety system first enters a safety mode. Preferably,this safety mode includes bringing the vehicle to a controlled stop withthe engine running. Following the safety mode, the robotics controlsystem permits the passenger to control the vehicle by the same manualoperation modes that were used to initiate the safety mode.

There may be alternate embodiments of the robotics safety system. Therobotic control system can be controlled according to a set ofdetections that are classified as indicative of the exercise of humanjudgment, and responses to these detections can be given higher priorityin behavior arbitration or action precedence than any programmed roboticreaction. In another embodiment, the robotic safety system may requireverification that the vehicle is under control by an operator in thevehicle. This embodiment may be desirable in a hostile environment whereit is not safe to bring the vehicle to a complete stop. In thisinstance, the robotic control system may combine a transition moderequiring verification that a human is in control, and/or in whichrobotic control system monitors whether the vehicle is under responsivecontrol by an operator. In yet another embodiment, such as in a trainingsituation, it may be desirable to shut down the engine. In thatinstance, when the vehicle is being controlled in autonomous mode and apassenger moves any of the manual operation members, the engine wouldshut down.

These illustrative embodiments are mentioned not to limit or define theinvention, but to provide examples to aid understanding thereof.Illustrative embodiments are discussed in the Detailed Description, andfurther description of the invention is provided there. Advantagesoffered by the various embodiments of this invention may be furtherunderstood by examining this specification.

FIGURES

These and other features, aspects, and advantages of the this inventionare better understood when the following Detailed Description is readwith reference to the accompanying drawings, wherein:

FIGS. 1A-1C are block diagrams of illustrative vehicles according tovarious embodiments of the invention.

FIG. 2 is a block diagram illustrating a steering system in oneembodiment of the invention.

FIG. 3 is a diagram illustrating a partial side view of a steeringsystem in one embodiment of the invention.

FIG. 4 is a diagram illustrating an exploded view of the steering systemin FIG. 3.

FIG. 5 is a block diagram illustrating a transmission system in oneembodiment of the invention.

FIG. 6 is a diagram illustrating a transmission system in anotherembodiment of the invention.

FIG. 7 is a block diagram illustrating a throttle system in oneembodiment of the invention.

FIG. 8 is a combination block and flow diagram illustrating a brakingsystem in one embodiment of the invention.

FIG. 9 is a diagram illustrating a partial side view of a braking systemin one embodiment of the invention, where the system is engaged and inautonomous mode.

FIG. 10 is a diagram illustrating a partial side view of the brakingsystem of FIG. 9, where the system is disengaged and in autonomous mode.

FIG. 11 is a diagram illustrating a partial side view of the brakingsystems shown in FIGS. 9 and 10.

FIG. 12 is a block diagram illustrating an E-Stop implementation in oneembodiment of the invention.

FIGS. 13A-D are functional schematic diagrams of an illustrative controlsystem according to different embodiments of the invention.

FIGS. 14A and 14B are functional schematic diagrams of an illustrativecontrol system according to another embodiment of the invention.

FIGS. 15A and 15B are functional schematic diagrams of an illustrativecontrol system according to another embodiment of the invention.

DETAILED DESCRIPTION

Embodiments of this invention provide systems and methods for switchingbetween autonomous and manual operations of a vehicle. Morespecifically, embodiments of this invention provide a vehicle,structures, systems, and methods, that are equally capable and inautonomous and manual modes: (i) by providing enhanced safety in allsuch modes; (ii) by being readily restorable to fully mechanical manualoperation and switchable to fully autonomous operation; (iii) byefficiently overlapping and combining components of autonomous controlsystems, manual mechanical control systems, and safety systems; or (iv)by having a human interface that simplifies processes of switchingbetween autonomous and manual operations of a vehicle and enhances theoperability and safety of vehicle use in either mode.

Illustrative Vehicle

Embodiments of the present invention may be used in a variety ofvehicles, such as automobiles, trucks, and utility vehicles. FIG. 1 is ablock diagram of an illustrative vehicle 102 in one embodiment of thepresent invention. The vehicle 102 shown in FIG. 1 is a six wheeled,diesel powered utility vehicle, such as a Gator™ vehicle manufactured byDeere & Company of Moline, Ill.

The vehicle 102 shown comprises operational systems, including asteering system 104, a braking system 106, a throttle system 108, and atransmission system 110. Each of these systems 104-110 preferablycomprises a mechanical input for operation in a manual mode, amechanical linkage for transferring force to the relevant mechanism, andan actuator for operation in an autonomous mode. “Mechanical” and“mechanical linkage” as used herein include fluid power systems unlessfluid power systems are specifically excluded. The autonomous mode is amode in which at least a portion of the vehicle is under at leastpartial computer control and may comprise, for example, robotic orremote operation, such as tele-operation. In tele-operation, a userpilots the vehicle 102 remotely using a remote monitor and controlsystem, referred to herein as an Operator Control Unit (OCU). The remotemonitor may rely on cameras or other sensors for determining thevehicle's 102 position and status.

Operation in the manual mode may comprise providing mechanical input andhaving the mechanical input translated to a force on the controlledsystem. For example, as illustrated in FIG. 1 the steering system 104 isattached or in communication with a steering wheel 112 for manualoperation. As illustrated in FIGS. 2-4 when a driver turns the steeringwheel 204, a shaft 206 attached to the steering wheel 204 turns a gearthat is intermeshed with a rack 207. The rack 207 is attached to thefront wheels 208 of the vehicle 102 and causes the wheels 208 to turn inthe appropriate direction based on the mechanical input. For thepurposes of this disclosure, the steering system 202 includes a steeringmechanism (which may be one of, e.g., rack and pinion; ball and nut; camand roller, lever, or peg, i.e., the family of mechanisms commonly knownas a steering mechanism in the art).

Similarly, a brake pedal 114 and parking (emergency) brake lever 116 areattached or in communication with the braking system 106. When the brakepedal 114 is pushed or the parking brake lever 116 is pulled orotherwise set, it applies pressure to a mechanical brake in thetransaxle of the vehicle 102. Typically, the parking brake lever 116connects via a separate cable to the mechanical brake, and can be usedalternatively to actuate the mechanical brake. In some cases, a separatebrake mechanism is provided for the parking brake lever 116. It shouldbe noted that setting the parking brake lever upon leaving the vehicle102 is recognized as a necessary safety “rule of the road,” so much sothat local ordinances and laws often define it as one of the legallymandated steps for leaving an unattended vehicle 102. Most drivertraining naturally teaches this rule of the road, and most adults areaccustomed to setting a parking brake lever 116 (or pedal 114) uponleaving a vehicle 102.

However, in normal manual operation, the braking system 106 is actuatedby the brake pedal 114 via its own connection (e.g., mechanical orelectrical); and in normal autonomous operation, the brake system 106 iseither actuated directly by autonomous control or via the brake pedal114 connection.

The throttle system 108 is similarly actuated, i.e., via a mechanicalconnection. Alternatively, each mechanical input may be translated to anelectrical signal before input to the operational system. For example,an accelerator pedal 118 is in communication with the throttle system108. When the accelerator pedal 118 is depressed, a sensor (not shown)sends a signal to the throttle system 108, indicating the level ofdepression. The throttle system 108 uses the signal to determine thevolume of fuel/air mixture to supply to the engine of the vehicle 102.

The vehicle 102 also comprises a gearshift lever 120 for selectingforward, neutral, or reverse (FNR) gears. In more complex vehicles 102,the gearshift lever 120 may select different gear ratios as well. Whenthe user moves the gearshift lever 120, a shaft attached to the lever120 and the transmission (not shown) is moved, causing the transmissionto switch gears.

Although these operational systems are described as havingmechanical-to-mechanical, or mechanical-to-electrical operation,different types of systems may be employed. For instance, abrake-by-wire system may be utilized in an embodiment of the presentinvention. In such a system, a sensor configured to sense the movementof the brake pedal 114 would cause actuation of the brakes without amechanical link. That is, while some expressions of the invention permitsome or all operational systems to be operated by a non-mechanicalinput, other expressions contemplate an arrangement in which essentiallyevery major operational system (steering 104, braking 106, throttle 108,and transmission 110) has a mechanical input, which has advantages asdiscussed herein.

Each of the operational systems includes at least one actuator. As shownin FIGS. 3-4, for instance, the steering system 202 may comprise anactuator 214 embodied as a motor capable of turning the steering shaft206. The actuators are utilized for operation of the vehicle 102 in anautonomous mode. The operational systems allow for fast, automatictransition from autonomous mode to manual mode. The transition fromautonomous to inoperative mode may be caused by an Emergency Stop(E-Stop), as will be discussed in more detail later. “E-Stop” is a termof art used herein, is a species of “controlled stop,” and is distinctfrom other controlled stops at least in that a reset operation isnecessary (often resetting a “mushroom” button), before any operation,manual or autonomous, is restored. This does not mean that an E-Stopbutton is directly connected to actuators, but many implementations doso. In many cases, based on the state of the vehicle 102, a controlledstop or an E-Stop may be a sequence of actions is initiated that bringsthe vehicle 102 quickly and safely to a rolling stop. An E-Stop mayrequire a reset; a controlled stop may not. On the other hand, atransition from autonomous to manual mode can be caused by specificcontrols (a changeover switch) or by operator intervention by use of anoperator intervention detector on a manual control (e.g., the operatormoves the brake pedal 114, steering wheel 112, gearshift lever 120, oraccelerator pedal 118). An operator intervention detector can be used toinitiate a controlled stop, or to permit operator “takeover.” If theoperator is to “takeover” the vehicle 102 via a changeover switch oroperator intervention (i.e., while moving, manual operation is engaged,autonomous is disengaged), this can be set preemptively (manual controloverrides without delay), or to warn the operator before permittingassumption of manual control.

In the embodiments illustrated in FIGS. 2, 5, and 8, three clutches areused, one each for the steering system 202, transmission system 302, andthe braking system 502. Alternatively, the throttle system 402 is alsocontrolled by an electromagnetic clutch. In manual mode, the clutchesdisengage the actuators from controlling the vehicle 102, removinginterference from robotics in manual mode. In other words, themechanical connection between the user's gearshift lever 120, steeringwheel 112, or pedal 114 and the mechanical end system is largelyunfettered. The user, thus, gets the manual experience that he expectsand the degree and character of tactile feedback are similar to anon-autonomous vehicle 102 of the same form factor.

For example, one embodiment of the present invention comprises anautonomous vehicle 102 including a mechanical vehicle control systemcapable of receiving manual inputs to operate the vehicle 102 in amanual mode; a controller capable of generating autonomous controlsignals; and at least one actuator configured to receive the autonomouscontrol signals and operate the mechanical vehicle control system in anautonomous mode, wherein the controller is configured to send a modeswitch signal to disengage the actuator from the mechanical vehiclecontrol system so that the vehicle 102 operates in manual mode.

Retaining manual functionality in this manner permits the operatorexperience to be indistinguishable from driving a vehicle with noautonomous modes, even following an E-Stop operation. An operatoraccustomed to driving an unmodified vehicle or vehicle of the same baseplatform will experience precisely the same tactile feedback fromdriving the multi-role vehicle as from driving a normal non-autonomousvehicle (using steering, accelerator, brakes, or gear shifting) of thesame kind.

The vehicle 102 also comprises a vehicle control unit (VCU) 122. Thevehicle control unit 122 receives input and utilizes the input todetermine how to control each of the operational systems 104-110. Forinstance, the vehicle control unit 122 may receive an input thatindicates that the vehicle 102 should be turned to the right. Inresponse the vehicle control unit 122 outputs a control signal to thesteering system 104 to cause the actuator 214 to turn the steering shaft206.

The vehicle 102 also comprises a robotic control system (RCS) 124. Therobotic control system 124 receives a variety of inputs from varioussources, such as a Global Positioning System (GPS) and other sensors anduses a combination of software and hardware to determine how to controlthe vehicle 102. The robotic control system 124 then outputs appropriatesignals to the vehicle control unit 122 to cause the vehicle 102 tooperate as desired. In some embodiments, the vehicle control unit 122and robotic control system 124 may comprise a single control unit. Inother embodiments the vehicle control unit 122 may comprise multiplecontrol units, also called robotic control modules, and the roboticcontrol system 124 may comprise multiple control units. Use of separateunits allows more flexibility in configuring the vehicle 102. Also, therobotic control system 124 can be configured to operate with multiplevehicle control units 122 so that the robotic control system 124 can bemoved from vehicle 102 to vehicle 102. For instance, if one vehicle 102is rendered inoperable, the robotic control system 124 can be removedand installed in another vehicle 102.

Both the vehicle control unit 122 and robotic control system 124comprise a processor. The processor comprises a computer-readablemedium, such as a random access memory (RAM) coupled to the processor.The processor executes computer-executable program instructions storedin memory, such as vehicular or robotic control algorithms. Suchprocessors may comprise a microprocessor, an application-specificintegrated circuit (ASIC), and state machines. Such processors comprise,or may be in communication with, media, for example computer-readablemedia, which stores instructions that, when executed by the processor,cause the processor to perform the steps described herein. Embodimentsof computer-readable media include, but are not limited to, anelectronic, optical, magnetic, or other storage or transmission devicecapable of providing a processor with computer-readable instructions.Other examples of suitable media include, but are not limited to, afloppy disk, CD-ROM, DVD, magnetic disk, memory chip, ROM, RAM, an ASIC,a configured processor, all optical media, all magnetic tape or othermagnetic media, or any other suitable medium from which a computerprocessor can read instructions. Also, various other forms ofcomputer-readable media may transmit or carry instructions to acomputer, including a router, private or public network, or othertransmission device or channel, both wired and wireless. Theinstructions may comprise code from any suitable computer-programminglanguage, including, for example, C, C++, C#, Visual Basic, Java,Python, Perl, and JavaScript.

The vehicle 102 also comprises a power supply 126. In the embodimentshown in FIG. 1, the power supply 126 is a separate power supply for thevehicle operations systems 104-110, vehicle control unit 122, androbotic control system 124. The engine, lights, and other systems of thevehicle 102 may utilize a separate power supply. In other embodiments, asingle power supply system 126 is used for the entire vehicle 102. Itshould be noted that the VCU 122 can be replaced with an additional RCU(e.g., RCU #5), or a combination of some RCU's replaced with one or moreadditional VCU's 122. To the extent that each of the RCU and VCU haveoverlapping capabilities, “RCU” and “VCU” as used herein are ofteninterchangeable.

In one such embodiment, the vehicle 102 is utilized as a militaryvehicle. As defined herein, a military vehicle is distinct from acivilian vehicle in that it is not necessarily subject to civiliantransport laws (e.g., it is not necessarily highway-licensable), andtherefore can be made capable of missions that would “break the law,”such as operating autonomously on any path, including civilian roads andhighways. The military vehicle may be sent to a front-line position inan autonomous mode. When it arrives, trained military personnel wouldtypically operate the appropriate manual-to-autonomous switch. Untrainedmilitary personnel may enter the vehicle 102 and press the E-Stopbutton, causing the vehicle 102 to exit autonomous mode and becomeinoperable as an autonomous unit until reset. The personnel are thenable to drive the vehicle 102 in a conventional manner. For instance,they can drive the vehicle 102 from the front line to a position in therear.

Illustrative Control System

FIG. 13A is a diagram of a robotic control system (RCS) 124, forexample, the robotic level control 704, in one embodiment of the presentinvention. FIG. 13B is a diagram of a vehicle control unit 122, forexample the vehicle level control 702, in one embodiment of the presentinvention. The two sections 702, 704 operate as a hierarchy where therobotic level control 704 has limited direct access to actuators thatare operated by existing vehicle level control 702. In contrast, insituations where robotic level control 704 instead replaces or subsumesvehicle level control 702, robotic level control 704 can substantiallydirectly drive vehicle operation systems via the actuators. The roboticlevel control 704 comprises four robotic a control modules or roboticcontrol units (RCUs) 738, 754, 744, and 762 and various sensors. Therobotic level control 704 receives various inputs from scanners, createsan obstacle map, determines control of the vehicle 102, and sendscontrol information to the supervisory vehicle level controller (VCU #1)714 and to the dashboard controller 722 (shown in FIG. 13B) that controlvarious operational systems of vehicle 102.

The vehicle level control 702 may optionally comprise one externalinterface, a controller area network (CAN) diagnostic port 706. Thevehicle level control 702 also comprises a power center 708 or othersmall load center module, such as a Siemens power center manufactured bySiemens Corporation. The power center 708 receives CAN communicationfrom the robotic level control 704 and then translates that CANcommunication into control signals, which it sends to the gearshiftmotor 710 and the brake motor 712. The gearshift motor 710 and brakemotor 712 are the actuators for the control of the transmission andbrake systems, 110, 108, respectively.

The vehicle level control 702 also comprises a supervisory vehicle levelcontroller (VCU #1) 714. In one embodiment, the supervisory vehiclelevel controller (VCU #1) 714 has odometry sensors and is able todetermine the velocity of the vehicle 102 if one of the odometer sensorson the wheels 208 fails. The supervisory vehicle level controller (VCU#1) 714 is in communication with various systems of the vehicle 102. Forinstance, the supervisory vehicle level controller (VCU #1) 714 is incommunication with the dump bed, auxiliary lights, and annunciator 716.In one embodiment, the auxiliary lights may be beacon lights. Thesupervisory vehicle level controller (VCU #1) 714 is also incommunication with the gearshift motor 710 and the brake motor 712.

The vehicle level control 702 also optionally comprises a throttlecontroller 718 for throttle control and diagnostics, such as, forexample, an APECS® model throttle controller provided by WoodwardGovernor Company, of Rockford Ill. The throttle controller 718 is incommunication with the throttle actuator 720. The throttle controller718 provides actuator signals to and receives feedback from the throttleactuator 720. In other implementations, this role may be served by arobotic control unit, motor, and electromagnetic clutch.

The vehicle level control 702 also comprises a dashboard controller 722.The dashboard controller 722 provides control for a mode switch 724 andfor headlights and blackout lights 726. The vehicle level control 702also comprises the steering actuator 728.

The robotic level control 704 also comprises external interfaces. Theexternal interfaces of the robotic level control 704 shown in FIG. 13Acomprise a rear payload CAN interface 730 and a rear payload Ethernetinterface 732. The external interfaces also comprise a front payload CANinterface 736 and Ethernet interface 734.

Various elements of the vehicle level control 702 are in communicationwith elements of the robotic level control 704. For instance, thesupervisory robotic level controller (RCU #1) 738 is in communicationwith the power center 708, throttle controller 718, and dashboardcontroller 722. The supervisory robotic level controller (RCU #1) 738receives input from various sensors and provides commands for operationof a vehicle 102 in an autonomous mode. U.S. patent application Ser.Nos. 10/972,082; 10/971,718; and 10/971,724, incorporated by referencein their entireties herein, describe exemplary autonomous modes andcontrol thereof.

In the embodiment shown in FIG. 13A, the supervisory robotic levelcontroller (RCU #1) 738 receives input from a GPSnavigation/communication system 740 (such as is available from NavComTechnology, Inc. of Torrance, Calif.) and from a compass 742. Thesesensors 740, 742 provide position and heading information to thesupervisory robotic level controller (RCU #1) 738 for navigationpurposes. Embodiments of the present invention may comprise othersensors as well. For instance, one embodiment comprises an inertialmeasurement unit (IMU), which measures acceleration of the vehicle 102in each direction. The supervisory robotic level controller (RCU #1) 738is also in communication with the rear perception robotic control module(RCU #3) 744. The rear perception robotic control module (RCU #3) 744receives sensor input via the rear payload CAN 730 and Ethernet 732interfaces.

In one embodiment, when a sensor, such as the rear laser scanner 752,fails or signals from the sensor are not received, the system isdesigned so that signals mimicking an object completely blocking thesensor are created. This way if, for example, a rear laser scanner 752fails, the vehicle 102 cannot move in a reverse direction, discussedbelow in part as the “range guard.”

The rear perception robotic control module (RCU #3) 744 is incommunication with a pair of radio receivers, radio (1) 746 and radio(2) 748. Radio (1) 746 may be 900 MHz, for example, and may be an EH900model manufactured by Nova Engineering, Inc. of Cincinnati, Ohio. Radio(2) 748 may be 2.4 GHz and may be 802.11b-compatible. The radios 746,748 allow the rear perception robotic control module (RCU #3) 744 toreceive commands from an operator control unit (OCU) 750, and totransmit video and other signals. The OCU 750 may be used, for example,for tele-operation of the vehicle 102 in an autonomous mode. The rearperception robotic control module (RCU #3) 744 is also in communicationwith the rear laser scanner 752, such as is manufactured by Sick AG ofGermany.

The supervisory robotic level controller (RCU #1) 738 in the embodimentshown in FIG. 13A is also in communication with a forward perceptionrobotic control module (RCU #2) 754. The forward perception roboticcontrol module (RCU #2) 754 is in communication with the dashboardoperator control unit (OCU) 756. In the embodiment shown, the dashboardOCU 756 comprises a personal digital assistant. One example would be theTDS Recon™ model as is manufactured by Tripod Data Systems of Corvallis,Oreg. The forward perception robotic control module (RCU #2) 754 is alsoin communication with a laser scanner motor 758 and a forward laserscanner 760.

The supervisory robotic level controller 738 is also in communicationwith a camera and steering controller (RCU #4) 762. The camera andsteering controller (RCU #4) 762 is in communication with a rear drivecamera 764 and a forward drive camera 768. The cameras 764, 768 may bethe SNC-CS3N model manufactured by Sony Electronics, Inc. of San Diego,Calif. The camera and steering controller (RCU #4) 762 is also intwo-way communication with the steering actuator 728 and supervisoryvehicle level controller (VCU #1) 714 of the vehicle level control 702.Finally, the camera and steering controller (RCU #4) 762 is able tocontrol the brake motor 712 via the supervisory vehicle level controller(VCU #1) 714. The camera and steering controller (RCU #4) 762 may sendand receive CAN signals between the supervisory vehicle level controller(VCU #1) 714, which in turn may send and receive CAN signals between thepower center 708. Next, the power center 708 sends control signals tothe brake motor 712. Accordingly, the camera and steering controller(RCU #4) 762 controls the brake motor 712 via the supervisory vehiclelevel controller (VCU #1) 714 and the power center 708.

The layout of the various controllers and sensors shown in FIGS. 13A and13B may be implemented in a variety of ways in embodiments of thepresent invention. For instance, the various controllers may be combinedor split in various ways depending on the number and types of sensorsused and depending on the configuration of the vehicle. Also, thevarious sensors and instruments may be utilized in various ways. Forinstance, embodiments of the present invention may utilize sensor fusionto operate efficiently and effectively. Sensor fusion allows the vehicleto operate even when certain sensors are inoperative.

FIG. 1B shows an alternate embodiment of a vehicle 130 with a steeringsystem 134 that is not controlled by the vehicle control unit 142 as isthe embodiment in FIG. 1A. Instead, the steering system 134 in FIG. 1Bis controlled by a robotic control unit (not shown) within the roboticcontrol system 146. The robotic control unit (not shown) within therobotic control system 146 controls the steering system 134 withlow-level control and feedback, and may also supply power to thesteering system 134.

FIG. 1C shows yet another embodiment of a vehicle 160. In thisembodiment, there are four RCUs 162, 168, 178, and 180 and no vehiclecontrol units as in FIGS. 1A and 1B. RCU 162 controls the steeringsystem 164, RCU 168 controls the braking system 170, and RCU 180controls the throttle system 182 and the transmission system 186. Theremaining RCU 178 may be a supervisory robotic control unit thatconnects and operates the other RCUs 162, 168, and 180. A power supply176 delivers power to each RCU 162, 168, 178, and 180, which in turndelivers power to the corresponding system.

FIG. 13C shows another embodiment of the vehicle level control 770 wherethere is only a single VCU, the supervisory vehicle level controller(VCU #1) 774. In this embodiment, the steering actuator 792 receives CANcommunication from the robotic level control 772, and also has afeedback loop with the robotic level control 772. The headlight andblackout lights 786 receive control signals from the power center 780,and the power center 780 supplies control signals to the gearshift motor782 and the brake motor 784. There is a mode switch 794 that providessignals to the supervisory vehicle level controller (VCU #1) 774.

FIG. 13D shows another embodiment of the vehicle level control 800. Inthis embodiment, there is a supervisory vehicle control unit (VCU) 804that corresponds to the supervisory vehicle level controller (VCU 1) inFIGS. 13B and 13C. The supervisory VCU 804 may send control signals,also called “digital with direction” in other embodiments, to the dumpbed, annunciator, and beacon lights 806. The supervisory VCU 804 mayreceive control signals from the mode switch 808. The supervisory VCU804 also receives feedback signals, also called “feedback loop” in otherembodiments, from each of the odometry sensors 809, the gear shiftactuator 812, the brake actuator 814, and the fuel solenoid 820. In theembodiment of FIG. 13D, there is a separate odometry sensor 809. Also,in other embodiments the gear shift actuator 812, brake actuator 814,and fuel solenoid 820 are referred to interchangeably as the gearshiftmotor, the brake motor, and the throttle actuator, respectfully. Thevehicle level control 800 also has a load center module 810, called a“power center” in other embodiments. The load center module 810 is inCAN communication with the robotic level control 802, and further sendscontrol signals to each of the gear shift actuator 812, the brakeactuator 814, and the headlights/blackout lights 816. Finally, thevehicle level control 800 may have an engine controller unit, or ECU818, called a “throttle control” in other embodiments. The ECU 818 is inCAN communication with the robotic level control 802, and controls thefuel solenoid 820 to deliver fuel to the engine.

In another embodiment shown in FIG. 14A-B, the RCUs 954, 944, do nothave integrated Ethernet switches. Instead, there are separate Ethernetswitches 970, 972, and 974 associated with each of the RCUs 954, 944,and 962. Thus, the embodiment shown in FIG. 14A still has an Ethernetnetwork, but the Ethernet switches 970, 972, and 974 are external of theRCUs 954, 944, and 962. In the vehicle level control 902 shown in FIG.14B, there is not a feedback loop between the steering actuator 928 andthe robotic level control 904. Instead, the steering actuator 928 iscontrolled by a steering and dashboard (VCU #2) 922. In certainembodiments, the steering and dashboard (VCU #2) 922 has an integratedcontroller that controls the steering actuator 928. In otherembodiments, however, the controller may be separate and detached fromthe steering and dashboard (VCU #2) 922. In one embodiment, a poweramplifier 930 is associated with the steering and dashboard (VCU #2)922.

In another embodiment shown in FIG. 15A-B illustrates alternativelayouts of the various controllers and sensors in which robotic controlmodules perform functions associated with vehicle control units. Forexample, FIG. 15A shows a robotic level control A 1504 having the samelayout as FIG. 13A, except the robotic level control A 1504 is incommunication with a second robotic level control, such as robotic levelcontrol B 1502 and illustrated in FIG. 15B. Robotic level control B 1502includes a low level controller 1514 that can receive commands from asupervisory RCU, such as supervisory RCU #1 1538, and control thevehicle dump bed and auxiliary lights 1516.

The robotic level control B 1502 may also include a gearshift motor RCU#5 1508 that can control a gearshift motor 1510 and communicate with thesupervisory RCU #1 1538. The gearshift motor 1510 may be an actuator forthe vehicle transmission. A brake motor RCU #6 1509 may be included thatcan control a brake motor 1512 that is an actuator for the vehiclebrakes. A throttle RCU #7 1518 may be included to control the throttleactuator 1520. In other embodiments of the present invention, therobotic control system may include more or less RCUs that are adapted tocontrol one, or sometimes more than one, component. For example, one RCUmay be included to control both the gearshift motor 1510 and brake motor1512.

Further variations of the layout embodiments of RCUs and VCUs within avehicle, such as in FIGS. 13, 14, and 15, are contemplated by theinventors via different combinations of the elements by theirinterfaces—e.g., an element controlled by CAN and having feedback can beconnected to either of an available RCU or VCU at either robotic orvehicle control level. Connections shown in the drawings as singleEthernet cables may be split into two or more cables to connect thenetwork as generally described herein.

In one embodiment, the vehicle is equipped with an ObstacleDetection/Obstacle Avoidance (ODOA) system that is designed to detectobstacles external to the vehicle, and to initiate the proper controlactions to avoid them. U.S. Provisional Patent Application No.60/780,389, filed Mar. 8, 2006, and U.S. [Attorney Docket No.56516/335072], entitled “Systems and Methods for Obstacle Avoidance”,filed concurrently herewith, more fully describes an ODOA system, and itis incorporated herein by reference. In one such embodiment, the vehiclecomprises the following components: (i) a forward nodding laser scannerassembly; (ii) range guard software; (iii) an obstacle map; and (iv)control software. The forward nodding laser scanner assembly gatherstrue 3-D data about obstacles in front of the vehicle and passes thatdata to onboard computers for processing. Certain embodiments can have arear fixed laser scanner assembly. The rear fixed laser scanner assemblygathers 2-D data about obstacles behind the vehicle and passes that datato onboard computers for processing. The range guard software detectsinterruptions of obstacle data from the laser scanners and publishessubstitute data that indicate that obstacles are close in everydirection that can be seen (“half moons”). This prevents the vehiclefrom moving in a direction that has not been positively determined to beclear of obstacles by the onboard software. The obstacle map indicatesthe relative positions of obstacles with regard to the vehicle, and thecontrol software determines the correct trajectory through the obstaclefield, and properly commands the control system (steering, throttle,brake, shift) to achieve that trajectory.

For fully autonomous modes of operation, such as navigation to GPSwaypoints, this system operates without modification. For normaltele-operation, this system is modified slightly to greatly reduce theamount of left or right turn that will be applied autonomously on top ofthe commanded tele-operation to avoid obstacles, but the autonomousbraking for obstacle avoidance remains fully in effect. Thus, if aremote operator tries to deliberately steer straight at an obstacle innormal tele-operation mode, the system will bring the vehicle to a haltin front of the obstacle. (In fully autonomous mode, the system willsteer the vehicle around the obstacle if there is a clear path.) Incases of, e.g., operational military necessity, the obstacle avoidancemay be turned off all together by selecting an appropriate key on theoperator control unit keyboard.

Embodiments of the present invention provide numerous advantages overvehicles able to operate only in an autonomous mode, and over vehiclesthat may be able to operate in both manual and autonomous modes. Forinstance, embodiments of the present invention allow a user to recoverfrom an accident, such as the vehicle running into a ditch, or performsimple tasks or tasks requiring greater maneuverability, such as puttinga vehicle in the garage, without complex programming. In addition,embodiments of the present invention can move in areas where electronicsare not allowed. For instance, the sensors on an embodiment of thepresent invention can be disabled in areas where they may be sensed byenemy sensors.

Start Method

As discussed above, while there are several different operator controlsor interface elements that may signify a state of being in readiness toenter autonomous mode, there are considerably less opportunities to takeadvantage of learned behaviors and training. There are tangible benefitsin safety, training costs, and operator confidence if the so-called userinterface of a machine is designed ergonomically. Human interface designfor entering autonomous mode can take many routes, e.g., messages,lights, sounds, keys and permissions, can all be used to guide theoperator's behavior.

Because the claimed invention may be used in both autonomous and manualmodes, it may be desired for the vehicle to enter autonomous mode from astanding start, and to have been placed into a safety configuration atthe time of entering autonomous mode. In other words, the vehicle shouldbe parked but should also be safely parked. At the same time, anoperator can readily determine that the vehicle is ready to enterautonomous mode, e.g., by some externally visible flag, symbol, or sign,preferably visible from tens of feet away. Of course, there is a limitedamount of dashboard and other space for interface elements, andcertainly for symbols visible from relative distance. Accordingly, thesymbol or sign would advantageously be adapted from one alreadyavailable on the vehicle. In addition, the operator can “undo”autonomous mode in the reverse manner that it was entered.

The controls and interface elements and actions of a manual vehicle canbe divided arbitrarily into sets, but there are only a few actions thatare part of standard driver training for a safe parking routine. One isto place the vehicle into park (for an automatic transmission); anotheris to set the front wheels turned toward or away from a curb dependingon uphill or downhill slope.

In one embodiment, setting the parking (or emergency) brake for enteringinto autonomous mode can offer combined functionality and humaninterface features that are advantageous. Setting the parking brake ispart of a safe parking routine, and many parking brake levers arevisible from a relative distance when set. Setting the parking brake isnot necessarily useful, however, because in traditional vehicles theparking brakes prevent the vehicle from moving. Releasing the parkingbrake renders the vehicle free to move, but would not be suitable forembodiments of the invention because a released parking brake does notshow an outside observer what mode the vehicle is in, and especially,whether it is ready to enter autonomous mode.

Accordingly, the embodiment illustrated in FIGS. 8-11 has an autonomousmode that cannot be entered unless the parking brake is set, and appearsas set. In certain embodiments the parking brake is set by the parkingbrake lever 506. As autonomous mode begins, the parking brake lever 506remains set to outward appearances, but has been overcome by autonomouscontrol so that the vehicle 102 is free to move. For example, FIG. 9shows the parking brake lever 506 engaged while the vehicle 102 is inautonomous mode. FIG. 10 shows the parking brake lever 506 disengagedwhile the vehicle 102 is still in autonomous mode. As can be seen fromFIGS. 9 and 10, the parking brake lever 506 appears to be set whetherthe brake is actually engaged or not. One manner of accomplishing thisis to internally relax or disengage the brake, and a particularmechanism and system for this is discussed herein. Another manner wouldbe to counteract the parking brake along the cable or other connectionto the braking system. In either case, however, there can be no instancein which the use of the parking brake causes safety risks beyond theordinary use of the parking brake. Releasing the parking brake, asdiscussed herein, optionally causes an E-Stop, a controlled stop, orentry into manual mode—but the vehicle is no longer autonomous.

It would also be possible to set an automatic transmission to “Park” asanother action associated with safe parking, but this does not offer allof the advantages of the parking brake routine, and particularly of theuse of the parking brake lever. For example, the position of a gearshiftlever is not readily determined outside the vehicle; and a mechanism forinternally releasing an automatic transmission while still leaving itshowing “Park” would be complex and expensive. Even automatictransmission vehicles have parking brakes, so it is preferable toestablish the parking brake routine across all autonomous vehicleslikely to be used by an operator.

As such, one aspect of the present invention is a vehicle that includesan autonomous mode starting system and method. First, the vehicleincludes, and permits and operator to set, a parking control elementthat is set in a predetermined setting when the vehicle is parked. Thispredetermined setting should be commonly perceived as signifyingdisabling movement, e.g., should be part of the ordinary rules of theroad and/or ordinary driver training. Optionally, this parking controlelement is visible from outside the vehicle, and/or other indicia aremade visible from outside the vehicle. The vehicle's control systeminterprets the predetermined setting as permitting autonomous mode. Adisengaging mechanism responsive to the control system disengages themechanism preventing autonomous movement, yet leaves the parking controlelement in the predetermined setting. In other words, the parkingcontrol element should continue in a position that signifies disabledmovement. Optionally, the disengaging mechanism is electrical, and wouldbe deactivated under E-Stop or power loss conditions, permitting thedisengaging mechanism to reengage. Should an operator move the parkingcontrol element from the predetermined position, the control systemcould engage manual mode and/or deactivate autonomous modes.

Thus, the internally disengageable parking control or brake has twoaspects, mechanically and functionally distinct. First, to start thevehicle in autonomous mode, the parking control is moved to a positionsignifying a safety-parking configuration to ordinary observers. Whenthe autonomous mode is started, the parking control internallydisengages from the braking systems, permitting movement. It isoptional, but advantageous, to leave the parking control electricallydisengaged but mechanically “charged” (i.e., mechanically biased toreengage upon the removal of electrical control) and/or further in theposition signifying a safe parking configuration. If the parking controlremains in the position signifying a safe parking configuration, thiscan signify readiness for autonomous mode or safe autonomous operation.If the parking control is electrically disengaged but remainsmechanically charged, it can be reengaged under electrical control orcan fail-safe to a braking condition when electrical power is lost. Thisis optional because, although it is practically necessary to have atleast means of fail-safe braking on the autonomous vehicle, suchfail-safe braking can be other than the parking controls.

Safety Stop System

Another embodiment of the claimed invention contains a safety stopsystem as illustrated in FIG. 12. As used herein, “safety stop system”includes an E-Stop subsystem, a controlled stop subsystem, and a systemfor changing from manual to autonomous modes. It is a feature of thepresent invention that the E-Stop system and the controlled stop systemshare certain components, and further that the system for changing frommanual to autonomous operation uses some of these components herein.

An E-Stop, or emergency stop, is a mechanical and electricalimplementation configured to disengage the “hazardous” systems of avehicle. Autonomous vehicles and E-Stops are subject to variousInternational Standards Organization (ISO) standards among them IEC/EN60947, IEC 60204-1 and/or ISO/IEC 13850. For example, IEC 60204-1,entitled “Safety of Machinery,” states that (i) the E-Stop override allvehicle functions in all modes, (ii) power to the machine actuators thatcan cause a hazardous condition(s) shall be removed as quickly aspossible without creating other hazards (e.g., by the provision ofmechanical means of stopping requiring no external power); and (iii) areset shall not initiate a restart. The standards require no“electronic” components in the E-Stop system, no single point offailure, and to remove power to all moving parts. A control orcontrolled stop, in contrast, utilizes software to disable some or allof the autonomous control systems. It is a feature of the presentinvention that the E-Stop system and the controlled stop system sharecertain components, and further that the system for changing from manualto autonomous operation uses some of these components herein.

A second network of switches, relays, clutches, and/or standard E-stop“mushroom” buttons may be provided in a drive-by-wire system, and thissecond network is connected by its own set of wiring and connections.This necessary facility is most often implemented in a manner thatsignificantly decreases available space and increases cost andcomplexity. On the other hand, drive-by-wire electrical networks aremore easily “E-stopped” than a system of mechanical actuators, which isanother reason why vehicles intended for only autonomous use typicallyare drive-by-wire.

The E-Stop implementation in the embodiment shown in FIG. 12 is asubsystem of the safety stop system designed to rapidly bring thevehicle to a quiescent state any time one of the several E-Stop buttonsprovided on the vehicle is pressed, or anytime the safety stop system isactivated by other means (see below). For example, while a controlledstop may be initiated by radio an E-Stop provides a human actuated meansto remove all potentially harmful sources of energy. In one embodimentof the present invention, activating the E-Stop subsystem has no effecton the operations of the vehicle when operated in manual mode. Althoughmanually operated vehicles are “machines,” typically they are notE-stopped (although tools, manipulators, and other machinery borne bythe vehicle may be E-stopped). Alternatively, the E-stop subsystem mayalso stop the vehicle in manual mode.

In one embodiment of the present invention, the E-Stop implementationcomprises several “E-Stop” switches mounted at various locations on thevehicle. These E-Stop switches are in the form of “big red buttons”(mushroom buttons), which may illuminate when pressed and an E-Stop istriggered. In one embodiment, a Gator™ model vehicle manufactured byDeere & Company of Moline, Ill. configured with the present inventioncomprises four E-Stop buttons, mounted on the left front of the litterrack, the right front of the litter rack, the dashboard in front of thepassenger's seat, and on the rear laser scanner sun shield (farthest afton the vehicle).

These switches are configured as a serial string, and additional E-Stopswitches can be easily added by lengthening the serial string ofswitches. The manner of lengthening the serial string of switches is aserial plug connector provided on each E-stop button. For example, whenthis system is applied to a vehicle longer, or wider, or havingdifferent operator locations (e.g., in comparison to a Gator™ modelvehicle discussed above), a cabled E-stop button, having its ownconnector, is strung to each new E-stop position. An E-stop button underthis system may have two plug connectors, or an attached cable and oneconnector. Additional E-stops are added in the same manner. Accordingly,this manner of arranging E-stops provides a simple reconfigurable way ofapplying the present safety systems to a vehicle of any size orconfiguration.

In the embodiment shown in FIG. 12, a power supply 602 provides power tothe autonomous systems of a vehicle. Attached to the power supply 602 isa series of push button break/relays, E-Stop (1) 604, E-Stop (2) 606,and E-Stop (n) 608. If any of the E-Stops 604, 606, or 608 are pressed,power to the autonomous system is disabled. If the vehicle 102 is movingunder autonomous control, the vehicle 102 will stop. Embodiments of thepresent invention allow the addition or removal of E-Stop buttons. Thisallows the customer to configure the number and placement of E-Stopbuttons.

FIG. 12 depicts a scenario in which all of the autonomous systems areE-stopped. However, in an alternative system, for the purposes of thesafety stop system, the autonomous systems includes robotic controlsystems that are connected to moving parts or that cause the vehicle 102to move (e.g., all of the operation systems of the vehicle 102, such assteering 104, braking 106, throttle 108, and transmission 110, as wellas any moving sensors or moving actuators), as well as robotic controlsystems that are not connected to moving parts (e.g., a supervisorycontrol system, the “brains” of the robotic vehicle 102, or roboticcontrol systems that are connected to passive sensors which do not movesuch as cameras or scanning devices). In such a case, FIG. 12 would notconnect the robotic control system 624 to the E-stop subsystem. Asupervisory robotic control system (such as that in FIG. 13A,Supervisory Robotic Level Controller (RCU #1) 738), would not beconnected to the E-Stop subsystem, and would continue to monitor thevehicle systems that report to it, as well as sensors, etc. In FIG. 13A,rear perception robotic control module (RCU #3) 744 would also not beE-Stopped, because it is not connected to any moving actuators, nor doesit control vehicle 102 movement (it is connected to radios 746, 748 andto rear laser scanner 752). In this configuration, the robotic vehicle102 may be monitored by communication channels independent of the E-stopsystem, may collect data regarding its surroundings via non-movingsensors, and may monitor and diagnose various conditions, including theE-Stop that just occurred.

Returning to FIG. 12, these E-Stop relays 604-608 control the power tothe engine controller and to the motors and actuators associated withvehicle systems having motion. They are a part of a serial string withE-Stop switches, and when any E-Stop switch is pressed the serial stringopens, removing power from all the E-Stop relays. When power to theengine control is removed, an engine fuel shutoff solenoid valve closesand removes fuel from the engine causing it to shut down. In oneembodiment, the motors and actuators powered through E-Stop relaysinclude: a steering motor, a nodding motor for the forward laserscanner, a shift actuator, and a brake actuator. When power is removedfrom these motors and actuators their motion stops. The steering clutchmay also be controlled by an E-Stop relay.

Also attached in series with the push button break/relays 604-608 is abrake pedal relay 610. The brake pedal relay 610 senses the depressionof the brake pedal (not shown). If the brake pedal is depressed, powerto the autonomous system is disabled. Note that it is a feature of theinvention that the brake pedal may trigger a standards-level E-Stop,E-Stop equivalent (missing only the big red button), or controlled stopin autonomous mode.

The embodiment shown also comprises a mode selector 612. The modeselector 612 allows a user to select a manual or autonomous mode. Likethe relays shown in FIG. 12, selection of the manual mode causes powerto the autonomous system to be disabled. In one embodiment, the modeselector 612 is used to reset the system after an E-Stop has beentriggered and then cleared, by pressing the Autonomous side of theswitch.

The vehicle 102 of the embodiment shown comprises several operationalsystems as described above. The operational systems comprise thesteering system 614, braking system 616, throttle system 618, andtransmission system 620. The operational systems work under the controlof a vehicle control unit 622. In autonomous mode, the vehicle controlunit 622 receives instructions from a robotic control system 624.

In one embodiment, a controlled stop is triggered by normal manualoperation of the vehicle, such as application of the foot brake,throttle, or steering wheel. In another embodiment, the electricalsystem is configured so that when the controlled stop system isactivated it only shuts off power to the autonomous control actuators(as discussed above). This way, the computers and sensors associatedwith the robotic control system still have power and are able tofunction.

As a whole, the safety stop system is a combination of the E-Stopsubsystem, the controlled stop subsystem, and the autonomous-to-manualchangeover subsystem. If the E-Stop subsystem is formally compliant withstandards it should be mechanically actuated, lack electronics, requirea reset operation, not restart the vehicle if reset, and meet otherconstraints as previously discussed. For this purpose, the E-Stopsubsystem includes four “normally disengaged electrical clutches”(disengaged when not powered), that is, four electromagnetic clutches216, 306, 406, and 508. As a clutch is defined as a device for engagingand disengaging, “normally disengaged electrical clutches” includesswitches, pins, relays, etc., which engage and disengage, but aredisengaged when not powered (they may also lock in a disengaged stateupon becoming not powered). The clutches are mechanically deprived ofpower by an open circuit when the E-Stop buttons are pressed. Theparking brake lever 506 is optionally outfitted with a mechanical switchthat creates an open circuit when the parking brake is released.

These same clutches, however, are also used for three main kinds ofcontrolled stops that are not E-stops.

First, a mechanically actuated controlled stop may be initiated that isnot an E-stop, by creating an open circuit (e.g., by holding a“momentary-off” button or disengaging a normally closed button switch)to the clutches. This could be treated by the control units 622, 624 inFIG. 12 as equivalent to an E-stop (if the initiating mechanicalswitches are not monitored) or other than an E-Stop if the initiatingswitches are monitored. This could be a controlled or emergency stop,but not a standards-level E-Stop, for example, because it does not use areadily recognized “big red button,” or because it would not necessarilyrequire a reset to reenter autonomous mode, or because some moving parts(e.g., moving sensors such as a sweeping scanner) could be left on.

Second, an electrically actuated controlled stop could be initiated bythe electrical, non-software system by a circuit that interrupts powerto the clutches via a relay or the like. This could occur for anylow-level reason determined to be hazardous, e.g., overheating, overvoltage, etc. This would be a controlled or emergency stop, but not astandards-level E-Stop for the same reasons as discussed above. Lastly,a stop could be initiated by software and control, for any of manyreasons. For example, a controlled stop could be initiated by a remoteoperator by radio or upon detection of a very close moving object, etc.This would also be a controlled or emergency stop, but not astandards-level E-Stop for the same reasons as discussed above. To theextent that it is impossible to chase down a moving vehicle to press a“big red button,” a fourth category, the “remote E-Stop,” also wouldexist. In such a case, the robotic control 622, 624 in FIG. 12 permitsoperation only so long as the remote “big red button” on the remote unitor OCU is actively sensed, communicated, and verified as “not pressed,”otherwise an E-Stop equivalent, using the clutches, is initiated and/ornot prevented from occurring.

These controlled stop systems could use engaging/disengaging mechanismsor clutches that are not part of the E-Stop subsystems. However, it is afeature of the present invention that the controlled stops can employone or more of the E-Stop “normally disengaged electrical clutches,”which are all be disengaged for an E-Stop to occur.

These same clutches can also be used to engage and disengage manual anddifferent autonomous operation control modes, including tele-operationmodes. In this sense, there can be a control difference betweendifferent autonomous modes. In fully autonomous mode, all of steering,braking, throttle, forward/reverse would require engaged clutches. Acruise control mode could engage only braking and throttle, leavingsteering to the operator. Another mode could engage only steering,leaving braking and throttle to the operator (following a patrol routeat the operator's preferred speed). Of course, fully manual mode woulddisengage all the clutches—but would not need to shut down any otherautonomous systems at all.

As such, one aspect of the present invention is a vehicle 102 thatincludes a safety stop system including an E-Stop subsystem (shown inFIG. 12) that removes power from all moving parts and from all partsthat cause the vehicle to move. The safety stop system enhances safetyin all modes and efficiently overlaps and combines components ofautonomous control systems, manual mechanical control systems, andsafety systems. For the parts that cause the vehicle to move, the E-Stopsubsystem includes a normally disengaged electrical clutch for each suchsystem, and powers down all of them in an E-Stop. The safety stop systemalso includes a controlled stop subsystem that stops the vehicle byremoving power from selected ones of the normally disengaged electricalclutches, while leaving other selected moving parts active. Optionally,a mode changeover switch 612 for switching between manual mode andautonomous modes, or between autonomous modes, also removes power fromselected ones of the normally disengaged electrical clutches, which mayor may not stop the vehicle, and may also leave all of the remainingpowered moving parts active. An E-Stop could be initiated after acontrolled stop, shutting down remaining moving parts.

The vehicle in manual mode thereby provides an enhanced level of safetyas it would be in a non-autonomous, unmodified configuration. Inautonomous or tele-operated modes with or without passengers, thevehicle includes E-Stop systems that will expediently bring it to arolling stop. Portions of these E-Stop systems, however, are adapted foruse in controlled stop situations, reducing cost, complexity, and thenumber of actuators necessary for both functionalities, and increasingthe reliability of the controlled stop subsystem. Further, thesesubsystems are again used for ordinary autonomous to manual switchover,which may or may not involve stopping or activation of moving parts.

Robotics Safety System

An embodiment of the present invention may also incorporate a RoboticsSafety System whose function is to govern the interaction between theonboard robotics and onboard personnel. Personnel may be onboard avehicle when it is operated in autonomous mode, and may need to takecontrol of the vehicle when called for by human judgment. An example ofthis could be in a medical evacuation scenario where wounded personnelare being cared for by an onboard medic, with the vehicle drivingautonomously to a helicopter-landing zone (LZ) for pick-up. Should thecondition of one of the wounded become more critical, the medic couldcall for a closer, alternate LZ, and take manual control to get thevehicle to its new destination.

The actions that onboard personnel take to control the vehicle in suchembodiments when transitioning out of autonomous mode need to be simpleand naturally understandable. Examples of such actions include brakingwith the brake pedal, steering with the steering wheel, shifting withthe shift lever, accelerating with the throttle pedal, and setting andreleasing the parking brake with the parking brake lever. When theonboard robotics interacts with an onboard person, the initial reactionof the robotics first accounts for the safety of the person, and thenallows the onboard person to take whatever action they judge best (humanjudgment takes precedence over programmed robotic reaction once safetyis accounted for). In addition, an embodiment of the present inventionmay provide onboard personnel and bystanders with an obvious indicationthat the system is operating in autonomous mode.

One embodiment of the present invention, for example the embodimentillustrated in FIG. 8, comprises a Robotics Safety System comprising thefollowing components: (i) electromagnetic clutches 508 between theoperational systems and actuators 522, also discussed above as thesafety stop system; (ii) a mechanical parking brake reversal mechanism;(iii) an autonomous/manual switch (mode selector) 510 on the dashboard;and (iv) a warning beacon and audio enunciator (beeper).

When such a system is operated in autonomous mode, electromagneticclutches in the brake actuator and the shift actuator, and with thesteering motor, engage to allow the onboard robotics to control the pathof the vehicle. When the vehicle is placed into manual mode, or when anE-Stop or controlled stop is triggered, these clutches are de-energizedand release, removing all robotic resistance to manual operation ofthese controls. This way, the vehicle responds in manual mode, as anoperator would expect it to.

The embodiment is also designed such that the parking brake is setbefore the system operates in autonomous mode. The mechanical parkingbrake reversal mechanism allows the brake actuator to function byovercoming the parking brake when the onboard robotics commands “brakesrelease,” and to allow the parking brake to set the brakes when theonboard robotics commands “brakes set”. Thus, if a power failure in theonboard robotics occurs and the brake actuator loses power, the parkingbrake will set the brakes through purely mechanical action, putting thevehicle into a safety state. Power failure to the brake actuator canoccur as a result of a system malfunction, of an E-Stop or controlledbeing triggered, or of the system being placed into manual mode ofoperation.

In the present system, the use of the parking brake has differentbenefits in this regard. First, the parking brake is set mechanically,and then internally relaxed by electrical actuators. This means that theparking brake will, in fact, re-engage when not powered. Second, theparking brake can be set to re-engage gently, i.e., with less than fullbraking force, to initiate a controlled mechanical rapid coast-to-stop,which is consistent with E-Stop standards. However, an E-Stop orcontrolled stop according to certain embodiments of the invention doesnot necessarily cause brakes to engage (for example, absent the parkingbrake system discussed herein, brakes are normally configured to engagewhen powered, not when not powered). The parking brake envisioned is anormally disengaged system that is engaged mechanically, and theninternally relaxed electrically. In contrast, a normally engaged“default brake” could be used, which engages unless electricallypowered. In a system powered by an electrical motor, the motor itselfcould slow the vehicle.

If the vehicle is being operated in autonomous mode, and is then placedin manual mode using the dashboard switch, the system will configureitself exactly as if autonomous mode had not been commanded: power isremoved from the actuators, motors, and electromagnetic clutches(although not from the engine if it is already running), which frees thesteering, shift, and brake to be actuated by an onboard person withoutinterference from the robotics. In addition, since the parking brake isset in order to operate in autonomous mode, the brakes will come on (ifthey were not already) through the action of the mechanical parkingbrake reversal mechanism. Then, if the onboard person wishes to drivethe vehicle manually, it is a natural reaction to release the parkingbrake by lowering the parking brake lever between the seats.

The vehicle in such an embodiment is also equipped with magneticallymounted amber rotating warning beacons, mounted on the forward and aftlaser scanner sun shields. The amber warning beacons operate wheneverthe vehicle is operated in autonomous mode, and can be easilyreconfigured. The vehicle may also be equipped with an audio enunciator(beeper), which sounds whenever the engine is commanded to startautonomously, and is silenced after a successful autonomous enginestart.

Accordingly, a robotics safety system is provided for a vehicle that iscapable of carrying on-board personnel, i.e., passengers. Passengersinclude persons who may become the driver; when the vehicle isautonomous, everyone is a passenger. The vehicle has a set of manualoperation members, such as levers and steering wheels, that areaccessible to the passengers. The manual operation members arepreferably the same operation members used to pilot the vehicle. When apassenger moves any of the manual operation members, the robotics safetysystem first enters a safety mode. Preferably, this mode includesbringing the vehicle to a controlled stop with the engine running (whichis distinct from an E-Stop at least in that the engine remains on).Following the safety mode, the robotics control system permits a pilotor driver to assert control of the vehicle by the same manual operationmodes that were used to initiate the safety mode. Further, the roboticcontrol system can be controlled according to a set of detections thatare classified as indicative of the exercise of human judgment, andresponses to these detections can be given higher priority in behaviorarbitration or action precedence than any programmed robotic reaction.

The robotics safety system is applied to a set of mechanical linkagesfor actuating operation systems, for example the braking system 502 inFIG. 8, directly from the control members. The robotics safety systemincludes normally disengaged electrical clutches 508 incorporated ineach mechanical linkage. In an autonomous mode, the electrical clutches508 are electrically engaged, permitting robotic control of the vehicle.Upon the initiation of any safety stop, the clutches 508 areelectrically deactivated, removing resistance of the electrical clutches508 to manual operation. Safety stops include E-Stops, as illustrated inFIG. 12, which stop all moving parts without electronics (via opencircuits); remote or automatic E-Stop equivalents, which may reproducethe same effects but using electronics or software as an initiator; andcontrolled stops and safety stops, which may leave the engine runningand/or moving (e.g., scanning) sensors active.

However, depending on the mission or application, the safety mode may bedifferent. In a hostile environment, “safety” may require that thevehicle not be stopped—in this instance, the robotic control system maycombine a transition mode requiring verification that a human is incontrol, and/or in which robotic control system monitors whether thevehicle is under responsive control by an operator (by algorithm andsensor, e.g., sensing an operator in the drivers seat and human patternsof control). In a training situation, “safety” may require engineshutdown

Optionally, a robotics safety system as discussed herein includes atleast one mechanically charged safety system, which is mechanicallybiased in a direction to suppress movement of a movable system such asan actuator, scanner, or the vehicle itself. This mechanically chargedsafety system permits movement of its movable system when an electricalrelaxing mechanism is activated by robotics control, overcoming orrelaxing the biasing force enough to permit movement. When electricalpower is removed for any reason, the mechanically charged safety systemengages, eventually or immediately stopping the movement to besuppressed. Preferably, this system is provided as an integral part ofthe parking brake system, which is one that is normally and naturallyplaced into a mechanically charged state by an operator.

A robotics safety system may include a manually operable member, such asa rocker switch or other switch, available to passengers in therobotically controlled vehicle. The manually operable member ismonitored by the robotics control system, and has autonomous and manualsettings. In the manual setting, the robotic control system removes itscontrol over any actuators necessary for driving the vehicle, includingover the mechanically charged safety system. The mechanically chargedsafety system then engages, stopping its associated moving system. Ifthe mechanically charged safety system is a parking brake, the chargedstate is released using the parking brake lever. This is the same actionthat is normally used to permit the vehicle to move forward, i.e., themanually operable member, when operated to engage manual mode, initiatesa series of actions that place the vehicle in a parked state with theparking brake set (although the engine may remain running).

When the manually operable member is set in an autonomous setting, thevehicle will only be permitted to enter autonomous mode when themechanically charged safety system is engaged. Preferably, themechanically charged safety system is engaged by using a second manuallyoperable member, such as the parking brake lever.

The various vehicle operation systems 104-110 (Braking, Throttle,Steering, Transmission) are described in detail below. These areexemplary and non-exclusive. In a vehicle or platform according tocertain embodiments of the invention, there can be different vehicleoperation systems, or vehicle operation systems of the same type.

Braking System

FIG. 8 is a combination block and flow diagram illustrating a brakingsystem 502 in one embodiment of the present invention. The brakingsystem 502 shown in FIG. 8 supports a manual braking mode utilizingeither the brake pedal 504 or parking brake lever 506. In FIG. 8, themanual mode is referred to as “normal operation,” although in someembodiments, normal operation may refer to an autonomous orsemi-autonomous mode of operation. In the manual mode, theelectromagnetic clutch 508 is disengaged; no power is supplied to it.Also, the mode selector 510 is set to manual mode. The mode selector 510may comprise a switch on the vehicle's dashboard or a menu option on ascreen available to the user.

If the electromagnetic clutch 508 is disengaged (power off) or the modeselector 510 is set to manual (decision 512), then pulling or settingthe parking brake lever 506 (decision 514) results in application of thebrakes 516. If the electromagnetic clutch 508 is disengaged (power off)or the mode selector 510 is set to manual (decision 512), thendepressing the brake pedal 504 also results in application of the brakes516.

The braking system 502 shown in FIG. 8 also supports an autonomousbraking mode. In the embodiment shown, the autonomous braking mode isonly enabled when the parking brake lever 506 is set. In otherembodiments, other means of enabling the autonomous mode may beimplemented.

A power supply 518 provides power to the electromagnetic clutch 508,which is engaged to enable the autonomous mode. The power supply 518also provides power to a controller 520. The controller 520 receivesinput from a robotic control system (not shown) or other inputs and usesthose inputs to generate actuator signals, which the controller 520provides to an actuator and potentiometer 522. In one embodiment, theactuator is a linear actuator, and the potentiometer is a linearpotentiometer that provides a signal indicating the position of thelinear actuator. The actuator and potentiometer cause the brakes 516 tobe applied in autonomous mode when the electromagnetic clutch 508 isengaged and the mode selector 510 is set to autonomous mode (decision512) and the emergency brake lever 506 is set (decision 514).

In such an embodiment, requiring the parking brake to be set acts as asafety feature, because if the electronics fail, the brakes 516 will bere-engaged. In one such embodiment, a cam unit acts as a variable forcelink between the parking brake lever 506 and the brake rod itself. Thecam unit allows the autonomous system to disengage the brakes 516 (whilethe parking brake lever 506 still remains in the set position) with muchsmaller actuators. The cam unit also acts as a passive safetydevice—when power is disabled, the brakes 516 are engaged.

Another embodiment comprises an autonomous vehicle 102 including amechanical braking system 502 capable of receiving manual inputs tooperate the mechanical braking system 502 in a manual mode, wherein themechanical braking system 502 comprises a parking brake 504 or 506; acontroller 520 capable of generating autonomous control signals when theparking brake 504 or 506 is activated; and at least one actuator 522configured to receive the autonomous control signals to operate themechanical braking control system 502 in an autonomous mode, wherein thecontroller 520 is configured to send a mode switch signal to disengagethe actuator 522 from the mechanical braking system 502 and engage theparking brake 504 or 506 so that the vehicle operates in manual mode.

Thus, the internally disengageable parking control or brake has twoaspects, mechanically and functionally distinct. First, to start thevehicle in autonomous mode, the parking control is moved to a positionsignifying a safety-parking configuration to ordinary observers. Whenthe autonomous mode is started, the parking control internallydisengages from the braking systems, permitting movement. For example,in both FIGS. 9 and 10 the parking brake lever 506 appears to be set,but the parking brake is only engaged in FIG. 9. It is optional, butadvantageous, to leave the parking control electrically disengaged butmechanically “charged” (i.e., mechanically biased to reengage upon theremoval of electrical control) and/or further in the position signifyinga safety-parking configuration. If the parking control remains in theposition signifying a safety-parking configuration, this can signifyreadiness for autonomous mode or operation. If the parking control iselectrically disengaged but remains mechanically charged, it can bereengaged under electrical control or can fail-safe to a brakingcondition when electrical power is lost. This is optional because,although it is practically necessary to have a way of fail-safe brakingon the autonomous vehicle, such fail-safe braking can be other than theparking controls.

As shown in FIGS. 9-11, braking systems 502 of certain embodiments mayinclude mechanical resistance such as a cam 530, compression spring 532,output rod 534, and cable 536. The exact amount of force required toovercome this mechanical resistance can be tuned, which permits a lowpower actuator 502 to disengage the parking brake 516. The mechanismworks by connecting a compression spring 532 in series with a cam 530and an output rod 534 using a cable 536. The cam 530 acts as a forcemultiplier between the compression spring 532 and the output rod 534. Asthe spring 532 is compressed, the force on the spring side of the cable536 naturally increases linearly proportional to the amount ofcompression by the spring constant. The eccentric cam 530 then reacts tothis force output by the spring 532 as two distinct profiles, the inputprofile 538 and the output profile 540. The ratio of the radii of thetwo profiles 538, 540 of the cam 530 determines the forcemultiplication, up or down, between the spring force side of the cable536 and the output rod force side of the cable 536, and the profiles538, 540 on the eccentric cam 530 set the ratio of these radii at agiven location of the cam 530. By putting the cam 530 in series with thespring 532, we can effectively set any output spring rate desired, evenrates with negative slopes.

Creating a mechanical system that acts like a spring with a nonconstant, possibly even negative, spring rate permits much smalleractuators 522 to counteract a built-in force bias that works with anengaging mechanism may require a larger force to oppose the engagingmechanism to facilitate a return to home position in the case of powerloss.

Throttle System

FIG. 7 is a block diagram illustrating a throttle system 402 in oneembodiment of the present invention. The throttle system 402 may operatein three different modes: manual electronic, manual non-electronic, andautonomous. When the power to the autonomous throttle system 402 is off,the electromagnetic clutch 406 is disengaged, and a manual electronicmode of throttle operation is enabled. In the manual electronic mode,movement of the accelerator pedal 404 results in a signal being sent toa controller 408. The controller 408 generates an actuator signal basedon the accelerator pedal 404 position and sends the actuator signal toan actuator 410. The actuator 410 controls a governor 412, which metersthe amount of fuel delivered to the engine 414. In one embodiment, thereis no separate governor 412, and the actuator 410 itself meters theamount of fuel delivered to the engine 414. Thus, in the manualelectronic mode, changes in the position of the accelerator pedal 404result in changes in fuel flow to the engine 414.

The throttle system 402 shown in FIG. 7 also supports a non-electronicmanual mode. To engage the non-electronic manual mode, the user pulls afuel shut-off pull pin 416. This configuration change disengages thegovernor 412, which may be embodied as a variable solenoid used tocontrol the throttle and engage a mechanical governor (not shown). Inother words, this configuration disengages drive-by-wire mode andswitches from electronic governor 412 to a mechanical governor (notshown). This mode may be utilized when power is not available to thecontroller 408 and actuator 410.

In an autonomous mode, power is supplied to the electromagnetic clutch406 by an autonomous system power supply 418. When the electromagneticclutch 406 is engaged, the controller 408 receives signals from arobotic control system 420 instead of from the accelerator pedal 404.The controller 408 generates actuator signals based on the input signalsas when it receives input signals from the accelerator pedal 404. Theactuator signals cause the actuator 410 to control the governor 412 andthereby the fuel flow to the engine 414. In autonomous and manualelectronic modes, a vehicle level power supply 422 provides power to thecontroller 408 and actuator 410.

Accordingly, in one embodiment of the invention, a robotic vehiclecontrol system includes at least one operation system, for example athrottle system 402 (or a steering, braking, or transmission system)that is disconnected from a remote mechanical operation member, anelectrically controlled local actuator 410 that controls the operationsystem, and a restoration mechanism that can be engaged or disengaged.When the restoration mechanism is engaged or disengaged appropriately, amechanical linkage between the remote mechanical operation member andthe operation system controls the operation system according to asetting of the remote operation member and the electrically controlledlocal actuator 410 is disengaged, and/or the remote operation member andmechanical linkage dominate or override the operation of theelectrically controlled local actuator 410. In certain embodiments, whenthe restoration mechanism is engaged, each operation system isbackdriveable.

The throttle system 402 as described herein is therefore an example of asystem that is not wholly mechanical, but retains mechanical “reversal”capability. As discussed herein, it is advantageous when all systems canbe restored to full mechanical operation by use of electricallydisengaged clutches. However, embodiments of the invention alsoencompass all electrical systems for certain aspects thereof, and asdescribed with respect to the throttle system 403, remains advantageouswhen one, some, or all mechanical operation systems are decoupled fromdirect mechanical control members to be electrically controlled, but arealso provide with a restoration mechanism such that they may be readilyrestored to full manual operation.

Steering System

FIGS. 2-4 illustrate a steering system 202 in one embodiment of thepresent invention. The steering system 202 comprises both manual andautonomous subsystems. The manual subsystem comprises a steering wheel204. The steering wheel 204 is attached to a steering shaft 206. Thesteering shaft 206 is connected to a steering rack 207, which isconnected to the wheels 208. When a user turns the steering wheel 204,the steering shaft 206 turns causing the rack 207 to move and the wheels208 to turn.

The steering system 202 also comprises an autonomous subsystem. Theautonomous subsystem comprises a power supply 210. The power supply 210provides power to a controller 212. The controller 212 utilizes avariety of inputs to generate control signals, which it sends to theactuator 214. The actuator 214 is capable of causing the wheels 208 toturn. In one embodiment, the actuator 214 comprises a motor that iscapable of producing sufficient torque to turn the steering shaft 206,which, in turn, turns the wheels 208. If the actuator 214 is embodied asa motor, the motor may be attached to the steering shaft 206 via aplanetary gear set 230. Other types of actuators 214 such as hydraulicor electromagnetic actuators may also be utilized.

In the embodiment shown in FIGS. 2-4, the actuator 214 is attached tothe steering shaft 206 through an electromagnetic clutch 216. In thedefault setting the power switch 218 is off and the electromagneticclutch 216 is disengaged. The clutch 216 is only engaged when the powerswitch 218 is on. Similarly, during any loss of power, theelectromagnetic clutch 216 is disengaged.

Since an electromagnetic clutch 216 is utilized, when the clutch 216 isdisengaged, there is a minimal effect on the feel of the steering to auser in manual mode. The user only turns the additional weight of theclutch plate 232 when the clutch 216 is disengaged. The user does nothave to turn the actuator 214. The steering assembly 202 is configuredto allow for correct power level, movement, and response time of thesteering.

In the embodiment shown in FIG. 2, the autonomous and manual subsystemsmay be connected to the wheels 208 via an AND gate 220. Thus, any inputsfrom the autonomous and manual systems are combined. If the resistanceof the actuator 214 and gear/belt connection is high, the operator willhave difficulty turning the wheel 204 and affecting the steering. On theother hand, if the resistance is low, the operator may affect thesteering even in autonomous mode. When the EM clutch 216 is unpowered,it is disengaged, and the vehicle 102 steers essentially as if theautonomous system was not there. As described herein, the steeringassembly 202 can also be provided with an operator interventiondetector, and the control system may disengage and/or disengage the EMclutch 216 upon operator intervention by any of the methods and systemsfor operator interaction described herein.

The autonomous system, by joining the manual system at a point upstream,can bring mechanical advantages. First, the autonomous control actuator214 uses the mechanical advantage (rack and pinion or otherwise)provided by the manual system. Second, the steering wheel 204 turns asthe vehicle 102 autonomously operates or operates with an operator inthe passenger compartment.

Alternatively, the EM clutch 216 may be arranged, or an additionalnormally-engaged-when-unpowered clutch may be provided, to disconnectthe steering wheel 204 and/or shaft 206 from the steering system 202when the vehicle 102 is in autonomous mode. In either case, the steeringwheel 204 may be provided with an operator intervention detector(distinct from an E-stop button) that initiates emergency stops oroperator takeover.

The embodiment shown in FIGS. 2-4 also includes one or morepotentiometers 222. The potentiometers 222 sense the movement of thesteering shaft 206. The signal from the potentiometers 222 providesfeedback 224 for use by the controller 212 in determining what signalsto send to the actuator 214. For instance, the controller 212 may send aparticular signal to the actuator 214 to turn the steering shaft 206 aspecific number of degrees. However, due to an obstruction under one ofthe wheels 208, the actuator 214 turns the shaft 206 a smaller number ofdegrees. Since the controller 212 is receiving feedback 224, thecontroller 212 can correct for this discrepancy.

Transmission System

FIGS. 5 and 6 illustrate a transmission system 302 in one embodiment ofthe present invention, which comprises both manual and autonomoussubsystems.

The manual subsystem comprises a gearshift lever 304. The gearshiftlever 304 is attached via an electromagnetic clutch 306 to atransmission with an integrated clutch (transmission/clutch) 308.Alternatively, the integrated clutch 308 is an electromagnetic clutch,and no additional electromagnetic clutch is necessary or provided. Whenpower is shut off to the electromagnetic clutch 306, movement of thegearshift lever 304 causes the integrated transmission/clutch 308 tochange gears. When power is applied to the electromagnetic clutch 306,the autonomous system is able to control the integratedtransmission/clutch 308. When the user moves the gearshift lever 304 andthe power is off, different gears are selected in the integratedtransmission/clutch 308, such as forward, neutral, and reverse. In otherembodiments, the gearshift lever 304 is attached directly to theintegrated transmission/clutch 308. The electromagnetic clutch 306 insuch an embodiment attaches the autonomous system to the gearshift lever304.

In the embodiment illustrated in FIG. 6 an additional tab is placed onthe gearshift lever 304 or shifting rod so that it can be connected withthe shifting actuator 314 for autonomous control. This preserves themanual aspects of the gearshift lever 304, allowing manual operation ofthe shifter. In one such embodiment, the actuator 314 is a linearactuator. A linear actuator typically costs less than more complexrotary actuators.

The autonomous system shown in FIG. 5 comprises a power supply 310. Thepower supply 310 supplies power to a controller 312. The controller 312receives various inputs, such as inputs from a vehicle control unit orrobotic control system (not shown), and outputs corresponding actuatorsignals to an actuator 314.

In certain embodiments the actuator 314 comprises a solenoid. Whenpowered, the solenoid moves the gearshift lever 304 via theelectromagnetic clutch 306, causing the transmission/clutch 308 tochange gears. Various other types of actuators 314 may also be utilized,such as hydraulic actuators or motors.

In one embodiment of the present invention, the transmission system 302includes a neutral switch and a reverse switch (not shown). The neutraland reverse switches provide means to calibrate the actuator 314 so thatthe autonomous systems are able to accurately select gears.

The foregoing description of the embodiments of the invention has beenpresented only for the purpose of illustration and description and isnot intended to be exhaustive or to limit the invention to the preciseforms disclosed. Numerous modifications and adaptations thereof will beapparent to those skilled in the art without departing from the spiritand scope of the this invention.

1. A robotically operable vehicle comprising: a mechanical vehiclecontrol system capable of receiving manual inputs from a mechanicaloperation member to operate the vehicle in a manual mode; a controllercapable of generating autonomous control signals; and at least oneactuator mated to the mechanical vehicle control system by at least oneelectrically actuated clutch, the actuator configured to receive theautonomous control signals and operate the mechanical vehicle controlsystem in an autonomous mode.
 2. The robotically operable vehicle ofclaim 1, wherein the controller is configured to send a mode switchsignal to disengage the at least one actuator from the mechanicalvehicle control system so that the vehicle operates in the manual mode.3. The robotically operable vehicle of claim 1, further comprising anE-Stop system operable to remove power from the at least oneelectrically actuated clutch.
 4. The robotically operable vehicle ofclaim 3, wherein the E-Stop system is not operable to remove power fromthe controller or from the mechanical vehicle control system.
 5. Therobotically operable vehicle of claim 1, further comprising an E-Stopsystem operable to remove power from one of a plurality of electricallyactuated clutches.
 6. The robotically operable vehicle of claim 1,wherein the mechanical vehicle control system comprises at least one ofa braking system, a steering system, a throttle system, or atransmission system.
 7. The robotically operable vehicle of claim 1,wherein the mechanical vehicle control system comprises a drive-by-wiresystem.
 8. The robotically operable vehicle of claim 1, wherein theautonomous mode comprises a first autonomous mode and further comprisinga mode changeover switch operable to switch between the first autonomousmode and a second autonomous mode.
 9. The robotically operable vehicleof claim 1, further comprising a pull pin coupled to the mechanicalvehicle control system, the pull pin configured to disengage the atleast one actuator from the mechanical vehicle control system so thatthe vehicle operates in the manual mode.
 10. A method for operating arobotically operable vehicle, comprising: receiving a manual input;operating the vehicle in a manual mode with a mechanical vehicle controlsystem, at least in part through the manual input; receiving a modeswitch signal from a controller; disabling the mechanical vehiclecontrol system with an electric clutch; and operating the vehicle in anautonomous mode, at least in part through an actuator.
 11. The method asin claim 10, wherein the actuator operates the vehicle in response toautonomous control signals generated by the controller.
 12. The methodas in claim 10, further comprising providing an E-Stop system thatremoves power from the electric clutch but not from the actuator. 13.The method as in claim 10, further comprising providing at least one ofa brake handle, a brake pedal, a throttle, a steering wheel, or agearshift lever to receive the manual input.
 14. The method as in claim10, wherein the mechanical vehicle control system comprises at least oneof a braking system, a steering system, a throttle system, or atransmission system.
 15. A robotically operated vehicle, comprising: atleast one normally disengaged electrically actuated clutch that connectsa mechanical vehicle control system and an autonomous control system;the mechanical vehicle control system capable of receiving manual inputsfrom a mechanical operation member to operate the vehicle in a manualmode when the clutch is disengaged; the autonomous control systemconfigured to operate the mechanical vehicle control system in anautonomous mode when the clutch is engaged; and an E-Stop systemconfigured to remove power from the clutch, while leaving power in theautonomous control system.
 16. The robotically controlled vehicle ofclaim 15, wherein the mechanical vehicle control system comprises aparking control element set in a predetermined setting when the vehicleis parked, the predetermined setting configured to enable the autonomousmode and signify that manual movement is disabled.
 17. The roboticallycontrolled vehicle of claim 15, wherein the E-Stop system is actuated bylatching switches that require a mechanical reset to restore power tothe clutch.
 18. The robotically controlled vehicle of claim 15, whereinthe E-Stop system is actuated by a self-latching push-button thatmechanically latches before the E-Stop system removes power to theactuator.
 19. The robotically controlled vehicle of claim 15, furthercomprising a safety stop to disengage the at least one clutch by acircuit other than a latching switch.
 20. The robotically controlledvehicle of claim 19, wherein the mechanical operation member can actuatethe safety stop.
 21. The robotically controlled vehicle of claim 19,wherein the safety stop engages the clutch in response to a softwarereset.
 22. The robotically controlled vehicle of claim 15, comprising atleast a steering system clutch and a throttle system clutch.
 23. Therobotically controlled vehicle of claim 15, wherein the autonomouscontrol system is capable of being controlled in a teleoperated modeaccording to remote commands.
 24. A method for operating a roboticallyoperable vehicle, comprising: mating a mechanical vehicle control systemand an autonomous control system with an electric clutch; disengagingthe clutch to allow the mechanical vehicle control system to operate thevehicle in response to manual inputs; engaging the clutch to allow theautonomous control system to operate the vehicle in response toautonomous control signals; and removing power in the clutch, whileleaving power in the autonomous control system, at least in part throughan E-Stop system.
 25. The method as in claim 24, wherein the E-Stopsystem leaves power in the mechanical vehicle control system.
 26. Themethod as in claim 24, wherein the E-Stop system is triggered uponreceipt of manual inputs by at least one of a brake handle, a brakepedal, a throttle, a steering wheel, a gearshift lever, or an E-Stopswitch.
 27. A method for autonomous mode starting of a roboticallyoperated vehicle comprising: receiving a first mode signal indicating anautonomous mode selection; determining that a parking brake lever hasbeen placed in a set position, wherein a parking brake is engaged;disengaging the parking brakes while maintaining the parking brake leverin the set position; and engaging an autonomous mode controlled by acontroller capable of generating autonomous control signals.
 28. Themethod of claim 27, further comprising: receiving a second mode switchsignal indicating a manual mode selection; disengaging the autonomousmode; and engaging the parking brakes.
 29. The method of claim 28,wherein the second mode switch signal comprises at least one of a signalindicating a movement of the parking brake lever or a signal indicatinga movement of a mechanical operation member.
 30. The method of claim 28,wherein the second mode switch signal comprises an E-Stop signal. 31.The method of claim 30, further comprising causing the vehicle to stop.32. The method of claim 31, further comprising causing an engine of thevehicle to stop.
 33. The method of claim 27, further comprising:receiving an input signal indicative of the exercise of human judgment;and prioritizing the input signal above the autonomous control signals.34. The method of claim 27, wherein engaging an autonomous modecomprises engaging at least one normally disengaged electrical clutchincorporated in a mechanical linkage.
 35. The method of claim 27,wherein the set position has mechanical bias.
 36. The method of claim35, further comprising an electrical actuator that overcomes themechanical bias to disengage the parking brake so that the parking brakereengages with the mechanical bias if the electrical actuator losespower.
 37. The method of claim 36, where the parking brake lever has anunset position that actuates a safety stop to remove power from theactuator.
 38. The method of claim 37, where the controller resets thesafety stop before the controller disengages the parking brake.
 39. Asystem for autonomous mode starting, comprising: a parking controlelement with a predetermined setting that disables movement in a manualmode; a controller to generate a signal indicating autonomous mode; anda disengaging mechanism to receive the signal and to enable movement inan autonomous mode, while leaving the parking control element in thepredetermined position.
 40. The system as in claim 39, wherein thedisengaging mechanism disables movement in autonomous mode and engagesthe parking brakes if the parking control element moves out of thepredetermined setting or if the controller generates an E-Stop signal.41. The system as in claim 39, wherein enabling movement in anautonomous mode comprises engaging at least one normally disengagedelectrical clutch incorporated in a mechanical linkage.
 42. A roboticsafety system for a robotically operable vehicle, comprising: amechanical vehicle control system capable of receiving manual inputsfrom a mechanical operation member to operate the vehicle in a manualmode; a robotic controller capable of generating autonomous controlsignals; at least one actuator configured to receive the autonomouscontrol signals and operate the mechanical vehicle control system in anautonomous mode; and at least one mechanically charged safety systemthat is mechanically biased to suppress movement of a movable system ofthe vehicle, comprising an electrically actuated clutch that releasesthe mechanical bias and permits movement of the movable system when theclutch is activated by the robotics controller.
 43. The robotic safetysystem of claim 42, wherein when electrical power is removed from therobotic controller, the clutch deactivates and suppresses movement ofthe movable system.
 44. The robotic safety system of claim 42, whereinthe mechanically charged safety system comprises a parking brake system.45. The robotic safety system of claim 42, wherein the moveable systemcomprises at least one of a wheel of the vehicle or a scanner.
 46. Amethod for safely stopping a robotically operable vehicle, comprising:operating the vehicle in an autonomous mode, at least in part through anautonomous control system; receiving a manual input from a parkingbrake; disengaging an electric clutch to prohibit control by theautonomous control system while leaving power in the autonomous controlsystem; and operating the vehicle in a manual mode, at least in partthrough a mechanical vehicle control system.
 47. A robotic controlsystem comprising: at least one operation system of a vehicle; at leastone electrically controlled actuator and at least one remote operationmember corresponding to each operation system; a mechanical linkagecomprising at least a restoration member that permits control of theoperation system by the remote operation member when the restorationmember is in an engaged state, and prohibits control when in adisengaged state; and wherein the actuator prohibits control of theoperation system by the remote operation member when the actuator is inan engaged state, and permits control of the operation system by theremote operation member when the actuator is in a disengaged state. 48.The system as in claim 47, where the actuator is disengaged when therestoration mechanism is engaged.
 49. The system as in claim 47, wherethe actuator is engaged when the restoration mechanism is engaged, andthe remote operation member controls the operation system.
 50. Thesystem as in claim 47, the operation system comprising at least one of asteering system, a throttle system, a braking system, or a transmissionsystem.
 51. The system as in claim 47, where the restoration mechanismis at least one of an electromagnetically actuated clutch or amechanical device including at least one of pull-pin, a lever, a pedal,a push button, or a switch.
 52. The system as in claim 47, where eachoperation system is backdrivable when the restoration mechanism isengaged.